7ec17875b3cad3a168300eeab9d2a42b8d9677ebd6f0ffba0bb721245402985e

Analysis

max time kernel
120s
max time network
134s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
25/12/2023, 06:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ָ/77169.org˵.htm
Size

4KB
MD5

e3917c7f4410faf63e3bdcfff5c33e81
SHA1

6848c2917ccc5e24578105ab31dcb23e451bcb10
SHA256

a05f31f26ce57b9e2d9bb6b242731186374c2a0b11d1723af7e107f2dac51ba8
SHA512

8b4fc3b9faa01722e49064f1f027f91860d0c7e6c8bffdcfe4465d6860857f0513784301902a10704684b8b706e9deddf0d39ad53db3f17ae09fee63eae7109f
SSDEEP

96:m1OQF/fRA2RWhwM6wIm4yRgJ/Snq6kVUVTWn0M9tJexGTHwG6ak:mXF/JA0Vde4JJ4jW0MH4xG0G6

Score

1^/10

Malware Config

Signatures

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\InternetRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Zoom	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Enable = "1"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Factor = "20"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{6009C131-A4A1-11EE-9E06-5628A0CAC84B} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\DownloadRetries = "2"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000fd817711386cdab176bf68c0e8ab8a5ed1c473767adcd5447399dfbd7f358b0a000000000e8000000002000020000000720c4c4bcc5996391c58e128b92928e8181ffc757dfab4555a28235e3ceb06bb200000008c7424acc8ac2d7f2a5ee6bbc5cf616325733a4befa358fe300ca7d81a436c3840000000036ee5a060dd95ad3803a3ca1344791bee223649b2c34574844f38a9028da1516aef46a4fee0039b92ea0a04fae06c209d9ff4190404c66dabafab4fae906c43	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d0bc7431ae38da01	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\GPU	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\InitHits = "100"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\IntelliForms	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU\Size = "10"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "409834224"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\PageSetup	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\International\CpMRU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\FaviconPath = "C:\\Users\\Admin\\AppData\\LocalLow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000033b2baa7c38bc34eb000abaaaac06d7800000000020000000000106600000001000020000000cbdc5d34e4f0e313f2166b338923034de6c5da01c1cec57acfe7a974b1075293000000000e80000000020000200000006b65142f40f7f4e2ce51bb212b022e29443439b17a317cb4df3b93efa74a2b9990000000d1eea4ce1b5bdc5ee71f9ef9c43938b48b386d6e4b3268f063890c449b52654a15279269a7fabcdad7f6a7b83f0ae1c22fc41efc6f798e1bedde22c8ffc7f6bd1160cafe58d3d78e5ef13d7c01bc30b0e6d6acbc95e0ae63d94e8fcc19f41c653cb4fa31b17ca5de1edeb5ddbed4fb6ef1fb7e2dfdaeb7d58e747ba5a6cc39a951e16279345b56059956051cec425cd640000000e24d08ba00e1738b9e61591c8922a9d67335038bc65e0627cf100d3ce877e886190b03e41a092e0367fd074d8ca0879d96cddbc557ab565385fde9ed0565b2ee	iexplore.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2320	iexplore.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2320	iexplore.exe
2320	iexplore.exe
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE
2224	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2224	2320	iexplore.exe	17
PID 2320 wrote to memory of 2224	2320	iexplore.exe	17
PID 2320 wrote to memory of 2224	2320	iexplore.exe	17
PID 2320 wrote to memory of 2224	2320	iexplore.exe	17

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\AppData\Local\Temp\ָ\77169.org˵.htm
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2320 CREDAT:275457 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC

Filesize
914B

MD5
e4a68ac854ac5242460afd72481b2a44

SHA1
df3c24f9bfd666761b268073fe06d1cc8d4f82a4

SHA256
cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f

SHA512
5622207e1ba285f172756f6019af92ac808ed63286e24dfecc1e79873fb5d140f1ceb7133f2476e89a5f75f711f9813a9fbb8fd5287f64adfdcc53b864f9bdc5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
23KB

MD5
a54f336b0f1187e43cea7a950d175016

SHA1
a48a03bf7d123c74ae0d4883501a7798301d4cc2

SHA256
93b49995bc88a122e5269d75c33c66708bd279d1e4fd0d4c1f43b2fc27e13ac9

SHA512
7f78b48b425529e356c8f5471c7c72a1630dd2a874f6f912c71578a994406edd5c69a50ee01be208fdd0ed02950648a8706e528da336e18744b3bb80d8796644

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
1KB

MD5
cb0cad683b888e65ad5a821aa327bf07

SHA1
5103e1cf30fa1e2794bd12a23faa9fc98f5d0c6a

SHA256
b6a2edeab5356e1618c8806d11049b89ce61966adb9c2f77326cf37613657c59

SHA512
fd30404ac838b07b761324c7b1016e6b8d56da04fea2c2467c0873bad7dc86ce8b31f72104bced3c950b0a5a4acb6392ca9a3bc17df5738107d540d189725a89

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7578303afcb894152c83ba60c4b0d0a5

SHA1
ead9bff1a28dd881d970b6d57693fc679f249aa6

SHA256
fd3ab408e871b27182805e249bd8bcb796e5bfb9bda834dcb769ee71fa57c6e2

SHA512
f253ea7dd53ba0cd30036b240f647f6f459b9126b2e549c1c9fc5a36dac38cebe8344136a55132d3399f58f22794c8184c250bd8029fca44c080c9bed57dc5cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
7a02479c9404c618c61073fe37aefdcc

SHA1
204b635e9e6ba82148224e0be6a2aad8fd41b6a4

SHA256
be23b1bcac43ec9e814b3029286a7e7633f1fd99ecd03407ac86e35d0d5af5d5

SHA512
bd2f77d2bdff7102570db1223020a0fe84d1e08bd7465fab8ea838f8a2817f1e53347fec43eb7d4f5ec54f0c2038e28f2b74cddfc2083b7c415e36937af38cab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
fdcc9d9696d1b971f45c30305b55a3d5

SHA1
55cabcff0ce387ec2e6ab588984e9fda61b6b7c0

SHA256
9ccac4e7ce47469c8d57825076e9f0d1f56124d8334018258fe9b22e374f6abc

SHA512
c3afdcafa4fa0cf41a00eafb3f78dbe6a8fd4b1cb846653b5593d25d1bd4c51f6c766f2efbcdb323d73ab3c72c3c07d8ac80bee817d42bb3e5d37e187e8c53fa

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
08fdc267b3964f62490d1e86258eccd0

SHA1
61d3e34c5490465f0bcf0708f53ea999688a1de9

SHA256
b2086cb0937c26a854913565fa26e940eb168019dbe9546a3c5b3ebb8f40f356

SHA512
7344b86fd3cc6d9127799ba80ca6e9ee4ec0ace290d993486075a0dcc7f652cfe25b8878ded1da1a4d108d9d2b40a2ebcf22619472432bd6be8f7c7578e58815

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
3ae4990603b46a922aa557f469e0be15

SHA1
fc6c1bf24746c7e6c2c073c920bf86b605b84ef4

SHA256
d7f7a43699a6e6fdbb34dedc8a42a3c26041f714f88a3230956bf73ba665c555

SHA512
5fad76aff8df9db92712dd4786e7543558d4774e5e5f8883fb9d77e92ddcff6000754d18f00b7a808414a2ba20aab0215ca232fea40b4919099374d8410afaf3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
acb4aef4884912f2fb781ec8d86ffaf8

SHA1
e250923ce4ffbf668216e87fe39342df95af7410

SHA256
6b1a05fcdc99caccd678756e260351b55276aa5bf6b36cac5efd443c83371786

SHA512
ca69b3dfa3fb59d26779e709e61e06ea6e03f60da44c47ea3ec4867e330edfa71616f74dcacb1b69b3accd0b1c17734cd6905e5327903007a2e65608aaa4803f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

Filesize
242B

MD5
1da91f9d8e31b58fc78446b197e2f44b

SHA1
2d92c1e6776d4f5c6be4c1b80ab28ab4a97ee5e6

SHA256
3f44bac7950ed7148b297dfad997aa5f7b42bb5566540cffca3128417375b4a5

SHA512
b09f4193ed688d1bab48a1a9983c8b43b57eca3c78c876dfd363d6518b58251c17bff80d91a03dbdaf307e25c2d41f4223ca90f76646dd048fa9b0d52993e52e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\Internet Explorer\Services\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico

Filesize
4KB

MD5
da597791be3b6e732f0bc8b20e38ee62

SHA1
1125c45d285c360542027d7554a5c442288974de

SHA256
5b2c34b3c4e8dd898b664dba6c3786e2ff9869eff55d673aa48361f11325ed07

SHA512
d8dc8358727590a1ed74dc70356aedc0499552c2dc0cd4f7a01853dd85ceb3aead5fbdc7c75d7da36db6af2448ce5abdff64cebdca3533ecad953c061a9b338e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar2BF6.tmp

Filesize
62KB

MD5
1d5be4fa63eaf83e30b7c90fa89b8910

SHA1
3f65995a49a80d6a41b8ab8ad341041b2262cd39

SHA256
ca5042ee37c615bac15952f5bfdb5b8041713cfcca507e070a6454d48759c53a

SHA512
7ef47477586bc1f6d8e1cb9e3b2a9957d8b030447f47710a38ec95539af908bbe598819f0cc7430d4a4e5f655b3aa8f33950b18ca6ab22395a36665e50dc053f

Download Submit